# Matching @timestamp syslog

**URL:** <https://discuss.elastic.co/t/matching-timestamp-syslog/81225>\
**Category:** Logstash\
**Created:** [April 4, 2017, 10:25pm UTC](https://discuss.elastic.co/t/matching-timestamp-syslog/81225 "2017-04-04T22:25:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jose\_Campos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jose_campos/32/11259_2.png) [@Jose\_Campos](https://discuss.elastic.co/u/Jose_Campos)\
**Post date:** [April 4, 2017, 10:25pm UTC](https://discuss.elastic.co/t/matching-timestamp-syslog/81225/1 "2017-04-04T22:25:26Z")

</div>

Hi there

Some days ago my data were matching with the timestamp, but something happened that It collapsed.

Here is how it was.

![](https://us1.discourse-cdn.com/elastic/original/3X/d/2/d2788ea694ecd027b09795d92a39382f72a079a9.PNG)

And here how it is today.

![](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3e52d91d9646dac56ed4396df5225097f6b6127e.png)

Can you help me with this?

Greetings.

---

<div class="post-metadata">

**Author:** ![jkuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkuang/32/72637_2.png) [@jkuang](https://discuss.elastic.co/u/jkuang)\
**Post date:** [April 4, 2017, 11:44pm UTC](https://discuss.elastic.co/t/matching-timestamp-syslog/81225/2 "2017-04-04T23:44:10Z")

</div>

What version of ES & Logstash were you on before and on now? Can you provide the Logstash input , filter, and output file. Did you move your nodes or data centers to a different location?

---

<div class="post-metadata">

**Author:** ![Jose\_Campos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jose_campos/32/11259_2.png) [@Jose\_Campos](https://discuss.elastic.co/u/Jose_Campos)\
**Post date:** [April 4, 2017, 11:51pm UTC](https://discuss.elastic.co/t/matching-timestamp-syslog/81225/3 "2017-04-04T23:51:45Z")

</div>

Thanks

Is ES cloud 5.1.2 and I am using logstash 2.0.

This is my input filter.

![](https://us1.discourse-cdn.com/elastic/original/3X/9/9/99c9cd6a69f332d06b07ccc70bdb7b4cc8a42631.png)

I did not anythig. I just realized that my information was like this, undone

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [April 5, 2017, 3:59pm UTC](https://discuss.elastic.co/t/matching-timestamp-syslog/81225/5 "2017-04-05T15:59:37Z")

</div>

@Jose_Campos  
Its hard to tell from your post - did you fix it?

---

<div class="post-metadata">

**Author:** ![Jose\_Campos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jose_campos/32/11259_2.png) [@Jose\_Campos](https://discuss.elastic.co/u/Jose_Campos)\
**Post date:** [April 5, 2017, 4:25pm UTC](https://discuss.elastic.co/t/matching-timestamp-syslog/81225/6 "2017-04-05T16:25:56Z")

</div>

Yes it is working normally. I don't know what happening, because yesterday was collapsed, and today made match.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2017, 4:26pm UTC](https://discuss.elastic.co/t/matching-timestamp-syslog/81225/7 "2017-05-03T16:26:28Z")

</div>

Closed on May 3, 2017, 4:26pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.